BBC NewsBorrowing was £17.4bn last month, the second highest October figure since monthly records began in 1993.
Finito World
For some time now, artificial intelligence has been accompanied by its own peculiar soundtrack: the end of the world.
Warnings about existential risk have moved from science fiction into respectable conversation. The more capable the models become, the argument goes, the harder they may be to control. We are invited to imagine an intelligence which escapes its box, deceives its creators, gains access to the outside world and begins pursuing objectives nobody intended.
Recent reports of AI agents escaping test environments, co-ordinating with one another and compromising systems belonging to Hugging Face might appear to provide precisely the nightmare scenario the pessimists have been waiting for.
But F1R3FLY Industries, the London-headquartered deep-technology company, has an interestingly different interpretation.
Its message is not that nothing happened. Quite the reverse. Its argument is that we may be describing what happened in the wrong language.
“This is a hacking story,” writes F1R3FLY President and CEO Stephen Alexander. The intruder happened to be software rather than a human being, but the essential vulnerability was familiar: permissions, credentials and the ability to move laterally from one system to another.
That distinction matters enormously. For years, cybersecurity has largely been organised around identity. Someone logs in, is authenticated and receives the permissions associated with that identity. If an attacker can acquire the right credentials – through phishing, a stolen token or a hijacked session – the problem becomes what cybersecurity professionals call lateral movement. The attacker gets through one door and discovers that there are corridors behind it.
An AI agent can inherit the same weakness. Give it the permissions of an administrator and, on conventional infrastructure, it may be able to reach what the administrator can reach.
What changes with AI is not necessarily the nature of the doorway but the extraordinary speed and scale of the thing passing through it. In the incident examined by F1R3FLY, around 1,200 agents were involved. They did not sleep, and they could attempt thousands of actions a minute.
That is frightening. But it is a rather different kind of frightening from an omnipotent artificial mind spontaneously deciding to extinguish humanity.
And different diagnoses produce different prescriptions. F1R3FLY has spent years developing an architecture intended to remove identity itself as an attack surface. Its system uses capabilities rather than the familiar model in which an authenticated user acquires a broad role. An actor – whether human or machine – receives narrowly defined capabilities permitting particular actions. An AI agent launched by an administrator therefore does not automatically inherit the administrator’s reach.
More radically, F1R3FLY’s architecture removes the lateral corridors. Channels cannot simply be guessed or constructed, while individual records have separate capabilities, channels and decryption. Compromising one therefore does not provide a route towards the next.
There is another important element. AI agents increasingly generate code themselves. F1R3FLY’s OSLF formal-verification system is designed to analyse such code before it executes, checking its mathematical structure and logic paths and blocking transactions which attempt actions beyond the agent’s permitted mandate.
The significance of all this extends beyond one company’s technology. The dominant AI debate can sometimes leave us with a strangely binary choice. Either AI is fundamentally controllable, in which case we accelerate, or it is potentially uncontrollable, in which case we must slow down.
F1R3FLY proposes something more practical: build an environment in which powerful AI can operate without being able to reach everything around it.
In fact, Alexander turns the usual argument on its head. Proper containment need not be a brake on AI. It may be what permits organisations to use autonomous agents more extensively. If an agent architecturally cannot touch anything outside its mandate, organisations can potentially entrust it with more work rather than less.
There are limits to the claim, and F1R3FLY itself is explicit about them. Its technology does not make an AI model wiser, benevolent or “aligned”. It governs what an actor can reach, rather than what it wants. The effectiveness of containment also depends on how the system is configured.
That distinction is important because nobody can presently know how the largest questions around advanced AI will resolve themselves. Existential-risk researchers may yet be right to worry about the capabilities of future systems. Nor does solving one class of cybersecurity vulnerability solve misinformation, autonomous weapons, labour displacement or the other problems accompanying increasingly capable AI.
But there is something refreshing about bringing the argument back down to earth. Human beings have always been rather good at imagining the monster and rather less attentive to the unlocked door. The AI revolution unquestionably changes the threat landscape because software can now operate with a speed, persistence and autonomy no human hacker possesses. Yet that makes the architecture surrounding AI more important, not less.
Perhaps the lesson of the latest alarm is therefore neither “AI will destroy us” nor “there is nothing to worry about.” It is more useful than either. If machines are becoming extraordinarily powerful, we should become extraordinarily careful about which doors we give them the keys to.
